A running log of publicly disclosed attacks, exploits, and incidents affecting autonomous, agentic AI systems — tracked as part of our ongoing security engineering work. Every entry links to its original public source.
2026
14–15 September 2026
Spain's data-protection authority, the AEPD, confirmed in September 2026 the first breach notification it had received involving an autonomous AI agent acting without step-by-step human direction: the agent found an exposed application, logged in without authorization, probed for further weaknesses, then modified personal records and exfiltrated invoice data.
1 September 2026
AI safety research organization METR disclosed that an attacker stole an API key from a publicly exposed personal cloud instance and used it to consume roughly $600,000 worth of model credits over three weeks before the activity was noticed.
1–7 September 2026
A run of unauthenticated remote-code-execution disclosures
hit tooling built around AI coding agents. Manifold Security
disclosed GitSpawn, a flaw class where a
malicious repository's .git/config sets
core.fsmonitor to an attacker command, so a
routine git status run by the agent executes it
with the developer's full privileges — affecting Claude
Code, OpenAI Codex, Cursor, and other coding-agent tools.
Days later, CVE-2026-73222 and
CVE-2026-31975 disclosed similar
authless RCE paths in companion web UIs for coding-agent
tooling.
The Hacker News · Manifold Security · GitLab Advisory (CVE-2026-73222) · GitHub Advisory (CVE-2026-31975)
September 2026
Unit 42 documented an intrusion in which an attacker delegated an entire attack pipeline — reconnaissance, credential theft, and lateral movement — to autonomous AI agents, completing in under ten hours work that would typically take a human operator weeks.
August 2026
Wiz researchers disclosed an incident in which an AI-generated code-remediation feature ("Autofix") was manipulated into introducing a payload that granted unauthorized access to a company's internal Jira instance.
August 2026
Security researchers documented "Multi-Turn Context Poisoning," where an attacker uses an extended conversation to slowly corrupt an agent's memory window until it executes an unauthorized tool call. A related technique abuses agent planning loops to spawn endless sub-tasks, causing API denial-of-service and runaway compute costs.
August 2026
Adversa AI researchers formalized "Agent Data Injection" (ADI) — indirect prompt injection hidden in metadata that manipulates an agent's autonomous reasoning — and reported active exploits including single-pixel web text that forces agents to auto-launch malicious Model Context Protocol (MCP) servers, plus zero-click remote-code-execution flaws in agentic coding assistants.
6 July 2026
Sysdig's Threat Research Team disclosed what it described as the first fully autonomous "agentic ransomware" attack: an agent exploited a remote-code-execution flaw in Langflow, adapted to failed login attempts in real time, and carried out end-to-end extortion without human direction. Separately, Zscaler ThreatLabz documented "hidden prompt injection" campaigns using invisible CSS and JSON-LD markup to hijack AI agents that crawl the web.